From ab088faa4ac3c2aa1add4c364fa02d058482a5a5 Mon Sep 17 00:00:00 2001
From: Sourav Mohapatra <mohapatr@codeaurora.org>
Date: Mon, 8 Jan 2018 16:25:05 +0530
Subject: [PATCH] qcacld-3.0: Fix potential buffer overflow

In the function sap_clear_session_param, sapctx->sessionId can have
value more than max value allowed for the array
mac_ctx->sap.sapCtxList.

Add sanity check for the variable sapctx->sessionId

Change-Id: I846a8a1435de63d0a2e34f23bc407e0a8fa53eb2
CRs-Fixed: 2162255
---
 core/sap/src/sap_fsm.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/sap/src/sap_fsm.c b/core/sap/src/sap_fsm.c
index f5184ebddc11..bec43406c67a 100644
--- a/core/sap/src/sap_fsm.c
+++ b/core/sap/src/sap_fsm.c
@@ -2079,6 +2079,9 @@ QDF_STATUS sap_clear_session_param(tHalHandle hal, struct sap_context *sapctx,
 {
 	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
 
+	if (sapctx->sessionId >= SAP_MAX_NUM_SESSION)
+		return QDF_STATUS_E_FAILURE;
+
 	mac_ctx->sap.sapCtxList[sapctx->sessionId].sessionID =
 		CSR_SESSION_ID_INVALID;
 	mac_ctx->sap.sapCtxList[sapctx->sessionId].pSapContext = NULL;